Install AWS CLI from the official bundle, not apt

`apt-get install awscli` failed with "no installation candidate": the package
lives in Ubuntu's universe component, so whether it resolves depends on which
image the runner uses rather than on anything this workflow declares. Same
class of bug as the missing Yarn.

Install the official v2 bundle instead — self-contained and identical across
images — in its own step so a failure names itself, and log the image identity
so the next surprise is diagnosable from the log alone.

.gitea/workflows/deploy.yaml

@@ -29,13 +29,29 @@ jobs:
       - name: Build
         run: yarn build
 
+      # `apt-get install awscli` failed with "no installation candidate" — the
+      # package is only in Ubuntu's universe component, so whether it resolves
+      # depends entirely on which image the runner happens to use. Install the
+      # official v2 bundle instead: self-contained, no distro packaging, and
+      # identical across images. The banner exists so the log identifies the
+      # image, since the failures so far have all been image drift.
+      - name: Install AWS CLI
+        run: |
+          echo "runner image: $( . /etc/os-release 2>/dev/null; echo "${PRETTY_NAME:-unknown}") $(uname -m)"
+          if command -v aws >/dev/null 2>&1; then aws --version; exit 0; fi
+          apt-get update -qq
+          apt-get install -y -qq curl unzip >/dev/null
+          curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/awscliv2.zip
+          unzip -q /tmp/awscliv2.zip -d /tmp
+          /tmp/aws/install --update
+          aws --version
+
       - name: Deploy to S3
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: ${{ secrets.AWS_DEFAULT_REGION }}
         run: |
-          apt-get update -qq && apt-get install -y -qq awscli > /dev/null
           aws s3 sync _site/ s3://${{ vars.S3_BUCKET }} --delete
           # sync guesses text/markdown for .md, which Firefox downloads
           # instead of displaying; text/plain shows the raw text in the tab